Everybody welcome to the first video in the module.
So as we talked about the previous video we're going to be going over a full assessment on no access
to domain administrator on a Windows domain network.
Now the first step we're going to want to do is take a look at our reconnaissance.
So we've got a range 1 9 2 1 6 8 1 100 to 1 0 3 is our scope.
So the first thing we want to do is just quickly do an end map scan to find out what we're working with
so and map 1 9 2 1 6 8 1 One hundred dash 1 0 3 which is our scope.
So go ahead and run that.
Perfect.
So if we take a quick look here it looks like one hundred.
This looks like a domain controller based on the fact that there's ELD up Cape password 5 cross domain.
So this looks like our domain controller so we'll keep that in the back of our mind so if we look at
one hundred we see here there isn't much going here 3 3 8 9 is up see we're not seeing anything too
fancy here.
But if we look at one of three we do start seeing a few we see a web service we see HDTV proxy and ADHD
is normally accustomed to a patchy Tomcat based on the ports with eight thousand nine.
So if we do a quick curl on this host 1 2 1 6 8 1 dot 1 0 3 import 80 80 do a quick look and see what
we get here so we could see a patchy tomcat.
So let's go ahead and just take a look at this in our browser go ahead and take a look at the Web site
up to 1 6 8 1 3 import 80 80 perfect.
So it looks like we got a base install of Tomcat Apache tomcat.
Looks like they have links to host manager and manager app.
So in some cases a admin might leave a patch of Tomcats management interface with the default credentials
of Tomcat tomcat.
So let's go ahead and just take a quick look and see if that's the case.
So if we do Tomcat we'll do Tomcat admin just to see because there's normally a few variations of this.
No let's do admin tomcat.
No.
All right let's try Tomcat and Tomcat
awesome.
All right.
So from this point we can actually start doing our exploitation we can deploy a wah file in here and
actually start gaining some code execution and a shell on the on the system.
Now what's good about this is sometimes if we're lucky the admin will be running example or Apache Tomcat
as a admin or a privilege user instead of a service user or a service service user.
So but we'll have to wait for the next video will we go over the exploitation process so this is just
us doing our initial recon and finding a few a few interesting things that we can use to leverage our
way to the initial access to the system.
Because with a D we need to kind of move into a domain user account to kind of leverage things a little
bit further.